From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f47.google.com (mail-qv1-f47.google.com [209.85.219.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1AC2C37D131 for ; Wed, 3 Jun 2026 18:04:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780509854; cv=none; b=KlFjcaAi0qBCEVw3C3uoZCWs5xed24vNabbCeRtVJvEsi0NNIy5szlt31h1Tm2IDGtIsht/jDb9kjZcBAmBLxOKAssZjGFzAux4PhAxUySIXNx257sQ0edNbchipy8g46rr4U1HIQ9EMMnQHwp3i+Wq4OYcvmngTK1M8z8ro4uw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780509854; c=relaxed/simple; bh=ZgR8OWPikv52PCAGJisqbNIfYHWZl0dOg8fibX517og=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=cGaHGleZOH4/bN2PQNod6z/wGF5cM+jUW9jQUNY1g1StfDSZyt0RCiZst7QPWApleSwutYZ+Ulo7zPs3NlffFnFRgcGTU7TxcUmQ0JVEklBeH3GqhvaA/8/Ec0tbrcUhjgfeVwtv8jGlHyaDL1FyvBd/EurRPdv/c5MPiBKZhsI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=KaDlUFvi; arc=none smtp.client-ip=209.85.219.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="KaDlUFvi" Received: by mail-qv1-f47.google.com with SMTP id 6a1803df08f44-8ccda0ac4fcso74133936d6.2 for ; Wed, 03 Jun 2026 11:04:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1780509851; x=1781114651; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=9OJLSpJcAwItE4blXgTc7q6TgMgouOivQcInXyYVhZs=; b=KaDlUFviiRbL8CU38a/Zaaqv9y9h8p5H5KkKjX/ywsZNJG/Z6PFurg/flU7U8m3aSO ciwWy2/S5jFA1ajyg30wr1RhFJsO8w0Zal2/vY0BhK4Dxl3D6nFxABPhIoC7hBFu53bh quHWYFVFLgO9spGzspGbVZnY32BxcZF2hMXnKhvvzmn9PvC/CEiyG+ozb7/FzRY8VF7u TRmaR8OV3g9oZYGW0yfVakDsc0mpletpASvvmfQJpzXA7IY8rqNPeiZF9Qy0CTTnvROV rc6C1qEk233A3VvaYaQ0h+voIAwuqIt+aTlmyFwFh8/62F4X4Bqwo3EdC0ryKTWRgubx 5KNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780509851; x=1781114651; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=9OJLSpJcAwItE4blXgTc7q6TgMgouOivQcInXyYVhZs=; b=AFqPajSJIfpkfeJbu+csq4IHrbfdeHk+UkYhcBcYAEa6nHHtWXOMPD/6o/OnnKBv/e BT+NryWK2TQDrJ074FD1jwD2NjpaWVFDKlaYty7d9kSqLBjYPvPfKb2Dq1WCRsgoOH97 0l+4465N+KXmR0pkqle5KI8cQO/36zJmljXwoOwwCZBz7wFv/m7r+ZxN4s68RH6+IhP7 oGV9kbVaUl+a88s5tIL55F9XtWHjMAXms9gX6CYCO6ApWJQb5gc7t52gTCN0PP4v2emH 1BRy0WtGNpVYlBqGZmou9isvMSVKaJwRO56RTU/TcKN8r/fmVGXnvoXUq7stcE9S6dD0 FemQ== X-Forwarded-Encrypted: i=1; AFNElJ/awraQN784S1decUIAb+U3WylZ8HQEi7emM05O37WQHz8YRh/yZduFFpb5xDaAp9NHmuONhw3TmCFxpfo=@vger.kernel.org X-Gm-Message-State: AOJu0Yyy2PD/D/7Hq9FGrWtMGQ4NboARL+aGfSMXxFVYIF+/elhSTSAU ekf+haLcxS+dVx8oChcvSC2psITZJN7YpKg/1IyWY1ApzgXea7EaQlXH0a6M3RH3/ok= X-Gm-Gg: Acq92OEBx0JiFV6Eozvzwstafxv4zt1VJ2b4a1C3BYKKBF+AXXUH+/B1VJ99oRVR7oa b8BjdgrJzhBJmE16yZzRQMBW1RzVEsgdA6NQdIeKkOFyicATFV6Vy2dglKLk4BYsJ7CkW5NKW4Z EEQfQ6+xo7KmEBxNXAGLopBxztyaSFKx/4LQuFKgLsBWKk6GfS9hLDvqlW5/oQJnsXWwJOhw/xX 2IOk+V7h4hjColl/O6cz6r8zhkHqhvpeTf2iMAgxGTRNIAuoJ1p4T32VGLYxOWj6CXKu7beiFLe mWmRxPQOH5ubkovVRf+zkNEUQgyzOuL44Z/zU+nGhhvvdJbTtmiSmO9gsQQrYIARZH2X3Yd5v6a cHj4Sn7FRzU2adwa5AC6VwRRUzXJDJlcQnhI36Ky4AJpSxQbBjgXT0/VllkfC+394rnbbbIDa3+ oJINilkEvQr249ghwNBdoifMBrjDPpvSfLxF7ilQ== X-Received: by 2002:a05:6214:5904:b0:8cc:f135:52ab with SMTP id 6a1803df08f44-8cece0455efmr65083756d6.39.1780509851067; Wed, 03 Jun 2026 11:04:11 -0700 (PDT) Received: from localhost ([161.35.96.86]) by smtp.gmail.com with UTF8SMTPSA id 6a1803df08f44-8cecd053032sm27930346d6.24.2026.06.03.11.04.10 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 03 Jun 2026 11:04:10 -0700 (PDT) From: Samuel Moelius To: Jamal Hadi Salim Cc: Samuel Moelius , Jiri Pirko , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , netdev@vger.kernel.org (open list:TC subsystem), linux-kernel@vger.kernel.org (open list) Subject: [PATCH] net/sched: act_nat: only rewrite IPv4 packets Date: Wed, 3 Jun 2026 18:04:06 +0000 Message-ID: <20260603180407.26100-1-sam.moelius@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit act_nat can process packets whose protocol is not IPv4 and then interpret the payload as an IPv4 header. Non-IPv4 packets may be modified based on unrelated bytes at the network header offset. The action is documented as IPv4 NAT and should leave other protocols alone. Check the packet protocol before parsing and rewriting the IPv4 header. Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius --- net/sched/act_nat.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c index abb332dee836..34d6ba2d4143 100644 --- a/net/sched/act_nat.c +++ b/net/sched/act_nat.c @@ -142,6 +142,9 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb, egress = parms->flags & TCA_NAT_FLAG_EGRESS; noff = skb_network_offset(skb); + if (skb_protocol(skb, true) != htons(ETH_P_IP)) + goto out; + if (!pskb_may_pull(skb, sizeof(*iph) + noff)) goto drop; -- 2.43.0